insert into database selected items on multiple listbox

wonderlhily

Error: Warning: mysql_real_escape_string() expects parameter 1 to be string, array given in C:\xampp\htdocs\mySalon\reservation.php on line 17 ($servicesHairID = mysql_real_escape_string ($_POST ['servicesHairID']);

<?php include("C:/xampp/htdocs/mySalon/connect_database.php"); ?>

<?php
session_start();

if (isset ($_POST['submit'],$_POST['completeName'],$_POST ['mobileNumber'],$_POST ['emailAddress'],$_POST ['date'],$_POST ['time'],$_POST['servicesHairID'],$_POST['termsCondition'])) {

$submit = $_POST['submit'];

//form data

$completeName = mysql_real_escape_string ($_POST ['completeName']);
$mobileNumber = mysql_real_escape_string ($_POST ['mobileNumber']);
$emailAddress = mysql_real_escape_string ($_POST ['emailAddress']);
$date = mysql_real_escape_string($_POST ['date']);
$time = mysql_real_escape_string($_POST ['time']);
$servicesHairID = mysql_real_escape_string ($_POST ['servicesHairID']);
$termsCondition = mysql_real_escape_string ($_POST ['termsCondition']);




if ($submit)
{
		if (!empty($_POST['completeName']) && !empty($_POST['mobileNumber']) && !empty($_POST['emailAddress']) && !empty($_POST['date']) && !empty($_POST['time']) && !empty($_POST['servicesHairID']) && !empty($_POST['termsCondition']) ) {
			$query="SELECT * FROM services_reserve WHERE completeName = '".$completeName."' 
			AND mobileNumber = '".$mobileNumber."' 
			AND emailAddress = '".$emailAddress."' 
			AND date_reserve = '".$date."'
			AND time_reserve = '".$time."'
			AND hairServices ='".$servicesHairID."'
			AND termsCondition ='".$termsCondition."'";



		$result = mysql_query($query);
		@$num_rows = mysql_num_rows($result);



		if ($num_rows == 0) {
			$query1="INSERT INTO services_reserve (completeName,mobileNumber,emailAddress,date_reserve,time_reserve,hairServices,termsCondition)
		VALUES ('$_POST[completeName]','$_POST[mobileNumber]','$_POST[emailAddress]','$_POST[date]','$_POST[time]','$_POST[servicesHairID]','$_POST[termsCondition]')";

	$result1 = mysql_query($query1);
			if(@result1 == 0) {?> 
			<script language="javascript">
			alert("Reservation detail has been send.Please check your email address for the confirmation.");
            </script> 
            <?
			}
			else { ?> <script language="javascript">
			alert("No record added.");
            </script><? }
	}
	else
		echo "";
}
else 
echo "Please fill in <b>all</b> fields!";
}
}

?>

HTML FORM

                <legend class="style29">Choose Type of Services</legend>
              <p>&nbsp;</p>

           <table width="400" border="0" style="font-size:12px">

              <tr>
                <td><span class="style13">Hair Services:</span></td>
                <td><p>
                  <select name="servicesHairID[]" id="servicesHairID" multiple="multiple">
                    <option value="Amino Mint Treatment">Amino Mint Treatment</option>
                    <option value="Cellophane">Cellophane</option>
                    <option value="Fill and Seal Vital Repair">Fill and Seal Vital Repair</option>
                    <option value="Hair Blow Dry">Hair Blow Dry</option>
                    <option value="Hair Color Promo">Hair Color Promo</option>
                    <option value="Hair Hi-Lite">Hair Hi-Lite</option>
                    <option value="Hair Mask">Hair Mask</option>
                    <option value="Hair Perming">Hair Perming</option>
                    <option value="Hair Rebonding any Lenght">Hair Rebonding any lenght</option>
                    <option value="Hair Relax">Hair Relax</option>
                    <option value="Hair Spa">Hair Spa</option>
                    <option value="Haircut">Haircut</option>
                    <option value="Hair Wax">Hair Wax</option>
                    <option value="Hot Oil">Hot Oil </option>
                    <option value="Ionic Keratin Treatment">Ionic Keratin Treatment</option>
                    <option value="Iron Straight">Iron Straight</option>
                    <option value="Keratin Treatment">Keratin Treatment</option>
                    <option value="Loreal Gloss Treatment">Loreal Gloss Treatment</option>
                    <option value="Loreal Hair Color">Loreal Hair Color</option>
                    <option value="Loreal Hair Spa">Loreal Hair Spa</option>
                    <option value="Milk Relax w/ free hot oil and haircut">Milk Relax w/ free hot oil and Haircut</option>
                    <option value="Powerdose">Powerdose</option>
                    <option value="Semi De Lino">Semi De Lino</option>
                    <option value="Semi Permanent Hair Color">Semi Permanent Hair Color</option>

                                        </select>



                </p>
                <p>&nbsp; </p></td>
              </tr>


          </table>
          </fieldset>


          <p>&nbsp;</p>
          <p>&nbsp;</p>
          <input name="termsCondition" type="checkbox" value="check" />
        By clicking the box, you Agree to the <a href="termsCondition.php" target="_blank">Terms and Conditions</a> of Keith Louise Salon and Spa.   

          <input type="submit" name="submit" value="Reserve"/>

        </form>

  </div>
 </div>
 </div>
  <div id="sidebar">
		<div id="news" class="boxed1">
			<h2 class="title">News &amp; Updates</h2>
			<div class="content">

		</div>
	</div>
</div>
<!-- end #sidebar -->
<div style="clear: both; height: 1px;"></div>
</div>
<!-- end #page -->




</body>
</html>

bradgrafelman

Several things..

Welcome to PHPBuilder! When posting PHP or HTML code, please use the board's [noparse]
```
..
```
or
```
..
```
[/noparse] bbcode tags (respectively) as they make your code much easier to read and analyze.
Where's your question? You posted plenty of background information (relevant source code(s), error message), but never asked any question.
As the error message states, you can't pass [man]mysql_real_escape_string/man an array, as it is expecting a string (hence the word 'string' in the function name itself).

$_POST['servicesHairID'] is not going to be a string but an [man]array[/man]; see the PHP manual for more information about this data type (although it's a basic data type common to just about all programming languages in use these days, so you're not just limited to the PHP manual). For example, you might consider [man]implode/man'ing the array into a string, or using a [man]foreach[/man] loop to examine the array's contents one-by-one.
Get rid of the '@' error suppressor; in my opinion, there's almost never a good time to use that operator.
Why do you sanitize a bunch of data, only to use the unsanitized versions of that data in the INSERT query later on? (Rhetorical question; don't do this!)
What is the purpose of the SELECT query followed by the INSERT query? If the goal is to prevent duplication, then get rid of the SELECT query altogether and instead define a key (either PRIMARY or UNIQUE, whichever makes most sense) in the table schema. That way, you simply INSERT the data every time and let the DBMS manage your data (isn't that the whole point of using a database in the first place?) and reject duplicates.

wonderlhily

could you give me example on how to use foreach loop

wonderlhily

could you give me example on how to use foreach loop on my code ? thank you

wonderlhily

ahm, where can i find the new post button?